Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 10:39

General

  • Target

    c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246.exe

  • Size

    1.8MB

  • MD5

    55a9a09c82b9a5ded1041d58acabeab1

  • SHA1

    f87de5cd57dfc500976a113239ab440e9dca5209

  • SHA256

    c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246

  • SHA512

    8dd15b933cf32efef9901c48787e637bcf8f14f74dd551b49df7129f076667e94a6c30db23c183a646bd3427ded746ec92131fefab48e34cd20e14bd6d0fa8d4

  • SSDEEP

    24576:k3vLRdVhZBK8NogWYO099OGi9JGRwNhAPoQxIC/hR:k3d5ZQ1TxJGRwNaPoQx

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246.exe
    "C:\Users\Admin\AppData\Local\Temp\c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246.exe
      "C:\Users\Admin\AppData\Local\Temp\c68e95ce90f8d65d4b3db04e258313772cf2168919bc1683ba36febd5ab2a246.exe" Admin
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40f2ba8764f8a358ef4c5ae1b1757845

    SHA1

    b9c6febf4f905350421e928abe10273e2be29c15

    SHA256

    8734caf8b572fe7b65774a72b13091213084af2904127035d8262ed51d8600a4

    SHA512

    6a455f179f29db1cbd05cd14ab77b9d13a0e74e085aea83b4098b68f76e8380a30a77981ab50eb275a6811b89737dcc96d19f34cb4fde3fff5b2397698c67400

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    51f86023f5553c6603e9543c00508334

    SHA1

    e4d00a353216edef05f33aefbcb139a455621fe1

    SHA256

    a86bc1491fcf68ab7f2766600417bd6e4d57bf0e116ea2eb22e7fbe50e8debab

    SHA512

    e740859b216232598aa9a25d7314c8e2ac60a8319c3482745e17abea0f15107fd4aa6ac00b4211849aa6d92bb4cbd34cd7fe8560c8280da4914bc9de9dd11bc9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5ba85f59a79bb34a92e880d081823210

    SHA1

    d62e0a5fdde6aee0ac4bd331f92a4471285694df

    SHA256

    7ece2e8c9e48b860d1a88a666aeca2601dbd5c862eefa97a713eea7b43a4d7ea

    SHA512

    07312b8ed827bbd12214b728be449f293238847887990fded3f1e557d8623f8d312de145b64f6e64c8919ba384138c56537645bc5af7eac8131e29de9458e413

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    35c26df075c9252d011a2a097740658f

    SHA1

    71ec59a52b80c80f63d4d5ff8709c504dc9633ec

    SHA256

    5a9a19a676dbc9d3b0c7d0fd41276ccb5ed7a9eae1806e400b51414c673af82a

    SHA512

    4eb5b77ef1cdb877521a28fd281ba5acef62c2200a346e24d61239d132dd4a26393127c0e19e040ba8406c9880b78966d7d52c806ef3fb630db588f1f661d0dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    938b9abb7dc44475bd9cbfc61ef9fc07

    SHA1

    074aa7aa3bdbbad55508b45ff8bc5c39c0664347

    SHA256

    019d30d7487ea75a9493bced87ef60967cddb051d18e6cd7699857f3a77db3be

    SHA512

    f3bf159c19d046992ba3e3b5ea492e8d434bebf4205e26b86213f436888034608002952722e7a98c985bc5f740974b9ba5017b0b54e902c496e58bf4de8b8ab4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    af6bf59a11fb438cd065172dfe74f26f

    SHA1

    87310736a842ae1e91b48574066a18a479be0790

    SHA256

    f88f0733e19d13559a9792d3db3dd38ff8921854ea3f570d203e734bce3a9efa

    SHA512

    af36214b79dccde875fc5f692a9fe047446c2d954f91b8e26b46de70a81c089bd873d8029c02a6b6df71ec435cb7e994650bc27fe568ad43f2e35ba7204f7358

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6de388038095969f503830b9ac753860

    SHA1

    767bf3a3c6cb79136615328e3a2aea1499f12117

    SHA256

    0fa810a3936411ed4208b5268ee1ca3f7923bb0c0b5e02a05b23444444f3a0ff

    SHA512

    e3e31cd237c66d7109b2267b1e1d7d255f99509aa939d815afc93062b811d4ec8232da7783e493e2dd6fe07f8ed26b7545065dd79e91f09afb29d301208dd131

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6674fb2a439259c5db510cabd7b95e17

    SHA1

    9be4d16d217cc195d192852b5b4d3350dcaef6f3

    SHA256

    68e4995132771e4802855ab3a0bc1a8beddbcee5227cf73c05a00f6da78da79b

    SHA512

    c82cccba558c5bd282a823a2aac502a5daee085b5ddabf9561e9c5fcf9c23fafc56719b94cf0541dee12092f5b529baeb5a6f86fbce0789d4087603b1b762340

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    284976cce8c0d139b8716d2316baa2bf

    SHA1

    5b6cca801fe643041a279b5343e5fd03c8ef1618

    SHA256

    965381205b6296e001490a8fb30a308a1c30ef86ed01aaff83e1bd11f7b68a85

    SHA512

    9145e02c611805300834038a5936b91f66324b4a939a53d293376011ea5ec9c31fcaa0a167c70958a44cc2ff83448307236090581d78e3f389baabf414e8944a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    924c0d00e49d641510caa5ff2954526e

    SHA1

    80131bcc2c019d8d3ca4b7f2dae51c66490c340b

    SHA256

    a5c17a639930956c81766970e02362455dbd5ba43c5c5150d19afadbf195feca

    SHA512

    e2d1ec568f4b27459cf2f28c939840a715a55893b66e085acc5f7e6f78ae15ba2e0270a462812aad105f351a122f1813dca1d91ec1c4e9868361a8855959b88f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    babc730305dbbda881456a98345bb925

    SHA1

    0fa5b61b985fec2f4139af9568d611042eb797ef

    SHA256

    f51df8327d05f3bef0db2324c079b5973fd4e8cde6cb160729a7f4993d0c72c6

    SHA512

    a07bf1a0d2ecc3ab495b4b4fa4d098b04406698125f8c1ec85823bc8bb5aeb8af560f308f2569cb6c1754a60c69332c304d221d1dfc9ee48d3cca7ff727663b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    25eb33f6a8c30a4ea680e308be54d039

    SHA1

    9e0b79e1dbc488d509b977fd5f307d1fa46e120c

    SHA256

    bcfacdb36c9fc65ef4e4208c8f95cd702f71e8d7a8616eec8b76692756ea407c

    SHA512

    afcdb7cbf44d95361e8e99e12f841359f359645bea5b9a63a5e94660fabeaecaa831adc6ecfb6ea1e451dda953cfd36c193914af3ab074a28d28780a01aafa44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7bac54a4628f8deb110f0669c2889272

    SHA1

    7681c3446039385d73bd77238f1409b34d36ce42

    SHA256

    046fc9ea3f843f4bba1af7d9f04217dc0456f922f5f7d333d762472d64d0ad9b

    SHA512

    679d060903cf579dd8ea4d1ce9d303e312ede49e618947c072a9fa9bef3fee11ba98ecd3707966c1d14ca71c61fee7a00d3253668c8d787104bedbdbfd67c534

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9799ce7666688c896321fac17779042

    SHA1

    bf8cdf44c300328a9b76e275b64198e0f0f90118

    SHA256

    59c248c42c008e66bfae2501631299d7882d943ea8de9ad907d93da84521b165

    SHA512

    f553dcb60069f3561187858e1cbff3607338dc9191f1dfa0f7785b1e1470ce1b92ea6ae7ccc3205310cc33e3301639eb2f301163f2346952fb5970187b4804e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08c42144e50cffa4ecd2773631e973df

    SHA1

    dd3b88d9beba22a231e30ccd87a0e7b007dd420b

    SHA256

    0de7f594a8afcab22caeb2785fce9d1589992688cd7b893d1d622ad99b4b6e62

    SHA512

    d0bb7f80ffe5e967ef7a80c26968cf60fb8b33578ba7e16bb08c12b7f0b24b9cc8290b762b0923affa988006dd1bace63f35ec9fa9370acb096ba66b74bdae7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90f7ad226c7a6f81b6e832e5c81984e1

    SHA1

    fc48c9a3407c052a58825b31706f5143cebb6d2a

    SHA256

    3cdd1a40b445b8245988f9c4f94bd11ee820573876b2f4a27effcde25904723f

    SHA512

    38a56334465f227f50a4fad0462611a5bbac9b0943b2e28564e422553d835bd28067659180ee8894922352f3eae7583bcb7278ab4807f7adf7058e78c5337548

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c234c1010f2fc6d698db5ec8691f233f

    SHA1

    b59b34cd219fec4d0e82edb5534ba9d210f50626

    SHA256

    6cfac03ea6ae719a8a2103386cf94d8c783c04902637460cdf79f8a52844c7b1

    SHA512

    e8e2cc4924e0c54cb5806ad6b00a72f9b2dadd5c584cfeac05d637488493357dc6fa653ec7793dec34db1268a5002be8ab4deeb780df48c574c55429d272ab99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    25f22011742dd3d9e59ddce622ec0049

    SHA1

    fc193cf495437b96bece95c4247397b58024f7ad

    SHA256

    2f683df23dac9b7d0897c103e00d40091947b0cbe10ac2c2991d539a86cbc30f

    SHA512

    68e505da02a9294cd4a559af7d04a86d23b0555c1f9407af070d3def844120cd067fb8d57f97fa5721ac79d97316c435f3a7e1c920bc68bf18d2d25161bd9b2e

  • C:\Users\Admin\AppData\Local\Temp\Cab23E8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar24A6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2188-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2188-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2188-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2188-0-0x0000000000400000-0x00000000005ED000-memory.dmp

    Filesize

    1.9MB

  • memory/2188-5-0x0000000003520000-0x000000000370D000-memory.dmp

    Filesize

    1.9MB

  • memory/2188-6-0x0000000000400000-0x00000000005ED000-memory.dmp

    Filesize

    1.9MB

  • memory/2620-7-0x0000000000400000-0x00000000005ED000-memory.dmp

    Filesize

    1.9MB

  • memory/2620-9-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2620-12-0x0000000000400000-0x00000000005ED000-memory.dmp

    Filesize

    1.9MB

  • memory/2620-14-0x0000000000400000-0x00000000005ED000-memory.dmp

    Filesize

    1.9MB